SSE-KMS is only supported for FSx

[jsknair]

Page: Change S3 bucket settings

This documentation kind of implies the SSE-KMS is supported across all platforms. But it is only supported on FSx. Please update it accordingly. Thanks.

[netapp-tonacki]

Hi jsknair, Thanks for your comment. I'm not exactly sure what you mean. What other platforms do you mean? Like a CVO system, or others?

Also, if a user creates an S3 bucket with SSE-KMS encryption, and then they populate data on it, will Data Sense be unable to scan the data? Or if a user creates a bucket with this encryption, would they be unable to tier data to it using Cloud Tiering?

Please let me know. Thanks, Tom

[jsknair]

Hello Tom, From what we learned, the FP client running in ONTAP does not support sse-kms for platforms other than FSx. This includes AFF/FAS and CVO. As far as how it will behave if the bucket is created with that encryption – that would need to come from CVO/FSx DEV team as I don’t have the means to test it out. Thanks, Sivakumar J Sr. Escalation Engineer – CORE From: Tom Onacki ***@***.***> Sent: Friday, April 21, 2023 12:58 PM To: NetAppDocs/bluexp-s3-storage ***@***.***> Cc: J, Sivakumar ***@***.***>; Author ***@***.***> Subject: Re: [NetAppDocs/bluexp-s3-storage] SSE-KMS is only supported for FSx (Issue #4) NetApp Security WARNING: This is an external email. Do not click links or open attachments unless you recognize the sender and know the content is safe. Hi jsknair, Thanks for your comment. I'm not exactly sure what you mean. What other platforms do you mean? Like a CVO system, or others? Also, if a user creates an S3 bucket with SSE-KMS encryption, and then they populate data on it, will Data Sense be unable to scan the data? Or if a user creates a bucket with this encryption, would they be unable to tier data to it using Cloud Tiering? Please let me know. Thanks, Tom — Reply to this email directly, view it on GitHub<#4 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AWXSG453O6VMBOATXPGSHK3XCK4CRANCNFSM6AAAAAAXG7P6SY>. You are receiving this because you authored the thread.Message ID: ***@***.******@***.***>>

[netapp-tonacki]

Hi, Just a quick update. I am still trying to get an answer to this information:
Also, if a user creates an S3 bucket with SSE-KMS encryption, and then they populate data on it, will Data Sense be unable to scan the data? Or if a user creates a bucket with this encryption, would they be unable to tier data to it using Cloud Tiering?